Two men from New Jersey were sentenced in federal court in Boston on Jan. 28 for their roles in a scheme that generated over $5 million to support the Democratic People’s Republic of Korea’s weapons of mass destruction programs. The operation involved dispatching skilled information technology workers, who used stolen identities of U.S. citizens to pose as domestic employees and secure remote IT jobs with American companies, including Fortune 500 firms and a defense contractor.
The significance of this case lies in its exposure of how stolen American identities and fraudulent employment practices can be exploited by foreign actors to access sensitive company data and fund activities that threaten national security.
Kejia “Tony” Wang, aged 42, was sentenced to nine years in prison followed by three years of supervised release after pleading guilty to conspiracy charges related to wire fraud, money laundering, and identity theft. Zhenxing “Danny” Wang, aged 39, received a sentence of 92 months in prison with three years supervised release and was ordered to pay $200,000 restitution after pleading guilty earlier this month.
In addition to the prison terms, both defendants were ordered to forfeit $600,000 received through the scheme; so far $400,000 has been recovered by authorities. “This case exposes a sophisticated scheme that exploited stolen American identities and U.S. companies to generate millions of dollars for a hostile foreign regime,” said United States Attorney Leah B. Foley. “The sentences imposed this week reflect the seriousness of this conduct and our commitment to holding accountable those who facilitate sanctions evasion and foreign threats from within our borders.” Assistant Attorney General John A. Eisenberg said: “For years, the defendants enriched themselves by assisting North Korean actors in a fraudulent scheme…thereby potentially harming our national security.” FBI Cyber Division Assistant Director Brett Leatherman added: “U.S. nationals who facilitate DPRK IT worker schemes…will face FBI investigation and potential prison time.” Other law enforcement officials echoed these warnings about ongoing risks posed by such operations.
Between approximately 2021 and October 2024, more than 80 Americans’ identities were compromised so overseas IT workers could obtain jobs at over 100 U.S.-based companies—costing victims at least $3 million in damages beyond lost revenue—including legal fees and network remediation costs. Kejia Wang traveled twice to China during this period for meetings related to the operation; he managed at least five facilitators hosting hundreds of victim company computers from their homes across several states.
Shell companies such as Hopana Tech LLC were set up solely as fronts for laundering proceeds from these activities back overseas—often directly into accounts controlled by North Korean co-conspirators—with nearly $700,000 paid out among six U.S.-based facilitators alone.
Sensitive employer data was also accessed without authorization under cover provided by these schemes—including technical files subject to International Traffic in Arms Regulations (ITAR) from an artificial intelligence defense contractor based in California during early 2024.
Law enforcement seized web domains used for fraud operations along with dozens of laptops during searches conducted across multiple states last year; eight additional alleged overseas operatives remain at large following indictments filed alongside those against Kejia Wang and Zhenxing Wang.